id: audit: produce the #3232 closing-audit evidence — field disposition table for artifact.rs never landed (closed as superseded) #5786

Summary

Produce the closing-audit evidence #3232 was for, or formally disposition why each piece is no longer needed. #3232 was closed on 2026-11-04 as "superseded" by the direct receipt-contract implementation (#5539, PR #5576) — but its acceptance deliverables were the evidence, and the evidence was never produced.

The record

#3232 (Phase 3 of #3231) was an audit-only issue: build the field-by-field disposition table for pkgs/id/src/artifact.rs — every field of every known kind plus every envelope field, each dispositioned (a) enforced at receipt, (b) deliberately unvalidated with reason, or (c) a gap filed as a named follow-up — plus five explicitly-required dispositions (unknown-kind bounds, document.content string governance, prev shape, builder-side symmetry of sign, world_id charset evidence), plus the contract statement written into the artifact.rs module doc.

The closure trail: the issue closed 2026-11-04T17:03:48Z; a later agent note (17:41Z) records task 4733 "completed as superseded," reasoning that because the Phases 1–2 gates had cleared and the implementation had landed directly, "the gated Phase 3 audit is superseded by that implementation; no audit worktree or code changes were made." The programme map on #2056 repeats the warning: closed state alone is not evidence the audit completed.

Why "superseded" doesn't close it

The implementation and the audit are different artefacts. The implementation asserts the contract; the audit was the check that every field is actually governed — its (c) category existed precisely to catch gaps the phases missed. An implementation landing without the disposition table means the gap-discovery step never ran: nobody has enumerated the fields against the rules since. Five named dispositions were required with their reasoning — none is recorded. The module-doc contract statement was an acceptance item; whether it landed is unverified.

What this issue asks

• Build the disposition table against current artifact.rs (post-id: implement One receipt contract for pkgs/id artifacts (design #3231) #5539/id(artifact): finish the receipt contract — frontier policy is Forbidden, builders refuse what receipt refuses #5576), exactly per Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232's scope: every known-kind field and envelope field, (a)/(b)/(c), with (c) items filed as follow-ups, not fixed here.
• Record the five explicit dispositions with reasoning.
• Verify (or land) the module-doc contract statement.
• If any part is genuinely moot post-implementation, disposition that in the table with the reason — the table is the deliverable either way.
• On completion, Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231's closure evidence links here.

Relations

Parent: #3231 (still open). Subject: #3232 (closed — do not reopen; this issue carries its unfinished evidence). Implementation under audit: #5539, PR #5576. Flagged by: PR #5707 §3 and the #2056 programme map. Filed in the 2026-11-04 gap pass (WS-F) as a done-check failure.